Missing authorization to unauthenticated arbitrary post deletion in Meta Box AIO (CVE-2026-14488)

The Meta Box AIO plugin for WordPress contains a missing authorization vulnerability in the MB Frontend Submission extension. The `handle_request()` function routes the `mbfs_delete` action without any capability or ownership check, and nonce verification is bypassable for `template_redirect` requests. Unauthenticated attackers can delete arbitrary posts and pages by supplying an attacker-controlled post ID via the `rwmb_frontend_field_object_id` GET parameter on any page hosting a frontend submission form. Affected versions: - <= 3.8.0 We recommend updating to: 3.9.0. CVSS 9.1 · our assessment: act_now Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/e9506f84-3d33-48e0-8dce-d517e1a923e4?source=cve Details: https://vuln.today/cve/CVE-2026-14488